@decantr/verifier 1.0.3 → 1.0.5

package/dist/index.js

@@ -1,5 +1,5 @@
 // src/index.ts
-import { existsSync as existsSync2, readdirSync, readFileSync as readFileSync2 } from "fs";
+import { existsSync as existsSync2, realpathSync, readdirSync, readFileSync as readFileSync2 } from "fs";
 import { readFile } from "fs/promises";
 import { extname as extname2, isAbsolute, join as join2, relative, resolve } from "path";
 import { evaluateGuard, isV3, validateEssence } from "@decantr/essence-spec";
@@ -1218,7 +1218,7 @@ function isAnonymousEntryLikeRoute(route) {
   return route === "/" || /(?:^|\/)(?:auth|login|log-in|signin|sign-in|signup|sign-up|register)(?:\/|$)/i.test(route);
 }
 function isProtectedLikeRoute(route) {
-  return /(?:^|\/)(?:app|dashboard|workspace|settings|billing|account|profile|admin|agents?|marketplace|transparency|logs?|metrics|config|console|studio|pipelines?|projects?|monitoring|overview)(?:\/|$)/i.test(
+  return /(?:^|\/)(?:app|dashboard|workspace|settings|billing|account|profile|admin|agents?|marketplace|browse|search|listings?|seller|buyer|bookings?|favorites|messages?|orders?|checkout|cart|transparency|logs?|metrics|config|console|studio|pipelines?|projects?|monitoring|overview)(?:\/|$)/i.test(
     route
   );
 }
@@ -1378,7 +1378,7 @@ function appendTopologyFindings(findings, essence, reviewPack) {
         evidence: [
           "Protected app surfaces need explicit routes so post-auth entry points are unambiguous."
         ],
-        suggestedFix: "Add explicit primary routes such as `/dashboard` or `/app` for the authenticated experience."
+        suggestedFix: "Add explicit primary routes such as `/dashboard`, `/app`, `/browse`, or `/listings` for the authenticated experience."
       })
     );
   }
@@ -1414,7 +1414,7 @@ function appendTopologyFindings(findings, essence, reviewPack) {
         severity: "warn",
         message: "Primary routes only expose auth-like destinations and do not appear to include a post-auth application surface.",
         evidence: [`Primary routes: ${topology.primaryRoutes.join(", ")}`],
-        suggestedFix: "Keep login and registration routes in the gateway section, and add at least one primary app route such as `/dashboard`, `/workspace`, or `/app`."
+        suggestedFix: "Keep login and registration routes in the gateway section, and add at least one primary app route such as `/dashboard`, `/workspace`, `/app`, `/browse`, or `/listings`."
       })
     );
   }
@@ -1426,7 +1426,7 @@ function appendTopologyFindings(findings, essence, reviewPack) {
         severity: "warn",
         message: "Primary routes do not appear to include a clear post-auth application destination.",
         evidence: [`Primary routes: ${topology.primaryRoutes.join(", ")}`],
-        suggestedFix: "Use at least one primary route like `/dashboard`, `/workspace`, `/settings`, or `/app` so the authenticated surface is explicit."
+        suggestedFix: "Use at least one primary route like `/dashboard`, `/workspace`, `/settings`, `/app`, `/browse`, or `/listings` so the authenticated surface is explicit."
       })
     );
   }
@@ -2022,13 +2022,13 @@ function appendSourceAuditFindings(findings, sourceAudit, essence, reviewPack) {
         id: "source-inline-styles-present",
         category: "Source Audit",
         severity: "warn",
-        message: "Source files still contain inline style attributes, which undermines the compiled treatment contract.",
+        message: "Source files still contain disallowed inline style attributes, which undermines the compiled treatment contract.",
         evidence: buildSourceAuditEvidence(
           sourceAudit,
           sourceAudit.inlineStyles,
-          "Inline style attributes"
+          "Disallowed inline style attributes"
         ),
-        suggestedFix: "Move inline styling into treatments, atoms, or design-token-backed classes so generation stays aligned with the Decantr contract."
+        suggestedFix: "Move static visual styling into treatments, atoms, or design-token-backed classes. Inline style remains acceptable for Decantr CSS-variable writes and truly dynamic geometry."
       })
     );
   }
@@ -2894,7 +2894,7 @@ function appendSourceAuditFindings(findings, sourceAudit, essence, reviewPack) {
       })
     );
   }
-  if (topology.hasAuthFeature && topology.primaryRoutes.length > 0 && (sourceAudit.signInFlowSignals.count > 0 || sourceAudit.authEntrySignals.count > 0 && sourceAudit.signUpFlowSignals.count === 0 && sourceAudit.recoveryFlowSignals.count === 0) && sourceAudit.authProtectedRedirectSignals.count === 0) {
+  if (topology.hasAuthFeature && topology.primaryRoutes.length > 0 && (sourceAudit.signInFlowSignals.count > 0 || sourceAudit.authEntrySignals.count > 0 && sourceAudit.signUpFlowSignals.count === 0 && sourceAudit.recoveryFlowSignals.count === 0) && sourceAudit.authProtectedRedirectSignals.count === 0 && sourceAudit.authSuccessSignals.count === 0) {
     findings.push(
       makeFinding({
         id: "source-auth-success-redirect-missing",
@@ -4378,6 +4378,7 @@ function getSkipNavTargetId(attributes, tagName) {
 function isAuthStorageKeyLiteral(node) {
   if (!node) return false;
   if (ts.isStringLiteral(node) || ts.isNoSubstitutionTemplateLiteral(node)) {
+    if (node.text === "decantr_authenticated") return false;
     return /(?:token|auth|jwt|session|access_token|refresh_token)/i.test(node.text);
   }
   return false;
@@ -8745,6 +8746,87 @@ function countLocalhostEndpointSignals(code) {
 function countWildcardPostMessageSignals(code) {
   return code.match(/\bpostMessage\s*\([^)]*,\s*['"`]\*['"`]/g)?.length ?? 0;
 }
+var DYNAMIC_GEOMETRY_STYLE_PROPS = /* @__PURE__ */ new Set([
+  "top",
+  "right",
+  "bottom",
+  "left",
+  "inset",
+  "width",
+  "height",
+  "minWidth",
+  "minHeight",
+  "maxWidth",
+  "maxHeight",
+  "transform",
+  "transformOrigin",
+  "opacity",
+  "offsetPath",
+  "offsetDistance",
+  "cx",
+  "cy",
+  "x",
+  "y"
+]);
+function getJsxAttributeExpression(initializer) {
+  if (!initializer || !ts.isJsxExpression(initializer)) return null;
+  return initializer.expression ?? null;
+}
+function getStylePropertyName(name) {
+  if (ts.isIdentifier(name) || ts.isStringLiteral(name) || ts.isNumericLiteral(name)) {
+    return name.text;
+  }
+  if (ts.isComputedPropertyName(name)) {
+    return getExpressionLiteralValue(name.expression);
+  }
+  return null;
+}
+function unwrapStyleExpression(expression) {
+  let current = expression;
+  while (ts.isParenthesizedExpression(current) || ts.isAsExpression(current) || ts.isTypeAssertionExpression(current) || ts.isNonNullExpression(current) || ts.isSatisfiesExpression(current)) {
+    current = current.expression;
+  }
+  return current;
+}
+function isDynamicStyleValue(expression) {
+  const unwrapped = unwrapStyleExpression(expression);
+  if (ts.isStringLiteral(unwrapped) || ts.isNoSubstitutionTemplateLiteral(unwrapped) || ts.isNumericLiteral(unwrapped) || unwrapped.kind === ts.SyntaxKind.TrueKeyword || unwrapped.kind === ts.SyntaxKind.FalseKeyword || unwrapped.kind === ts.SyntaxKind.NullKeyword) {
+    return false;
+  }
+  return true;
+}
+function isAllowedInlineStyleObject(objectLiteral) {
+  let sawGeometryProperty = false;
+  let sawDynamicGeometryValue = false;
+  for (const property of objectLiteral.properties) {
+    if (!ts.isPropertyAssignment(property)) return false;
+    const propertyName = getStylePropertyName(property.name);
+    if (!propertyName) return false;
+    if (propertyName.startsWith("--d-")) {
+      continue;
+    }
+    if (!DYNAMIC_GEOMETRY_STYLE_PROPS.has(propertyName)) {
+      return false;
+    }
+    sawGeometryProperty = true;
+    if (isDynamicStyleValue(property.initializer)) {
+      sawDynamicGeometryValue = true;
+    }
+  }
+  return !sawGeometryProperty || sawDynamicGeometryValue;
+}
+function isAllowedInlineStyleAttribute(attribute, sourceFile, namedExpressions, namedPropertyAliases) {
+  const expression = getJsxAttributeExpression(attribute.initializer);
+  if (!expression) return false;
+  const resolved = resolveObjectLiteralExpression(
+    expression,
+    sourceFile,
+    namedExpressions,
+    namedPropertyAliases,
+    /* @__PURE__ */ new Set()
+  );
+  return resolved ? isAllowedInlineStyleObject(resolved.objectLiteral) : false;
+}
 function analyzeAstSignals(filePath, code) {
   const sourceFile = ts.createSourceFile(
     filePath,
@@ -8836,7 +8918,14 @@ function analyzeAstSignals(filePath, code) {
   const walk = (node) => {
     if (ts.isJsxAttribute(node)) {
       if (isPropertyNamed(node.name, "style") && node.initializer) {
-        signals.inlineStyleAttributeCount += 1;
+        if (!isAllowedInlineStyleAttribute(
+          node,
+          sourceFile,
+          namedExpressionInitializers,
+          namedPropertyAliases
+        )) {
+          signals.inlineStyleAttributeCount += 1;
+        }
       }
       if (isPropertyNamed(node.name, "dangerouslySetInnerHTML")) {
         signals.dangerousHtmlCount += 1;
@@ -10400,7 +10489,7 @@ function critiqueSource({
       })
     );
   }
-  const hasInlineStyleLiterals = astSignals.inlineStyleAttributeCount > 0 || /style\s*=\s*(?:\{\{|["'])/.test(code);
+  const hasInlineStyleLiterals = astSignals.inlineStyleAttributeCount > 0 || /style\s*=\s*["']/.test(code);
   if (antiPatternIds.has("inline-styles") && hasInlineStyleLiterals) {
     findings.push(
       makeFinding({
@@ -10411,9 +10500,12 @@ function critiqueSource({
           "theme-consistency"
         ]),
         message: "Inline style literals were detected in the reviewed file.",
-        evidence: [filePath, `Inline style attributes: ${astSignals.inlineStyleAttributeCount}`],
+        evidence: [
+          filePath,
+          `Disallowed inline style attributes: ${astSignals.inlineStyleAttributeCount}`
+        ],
         file: filePath,
-        suggestedFix: "Replace inline visual values with treatments, decorators, and CSS variables from the compiled contract."
+        suggestedFix: "Replace static inline visual values with treatments, decorators, and CSS variables from the compiled contract. Keep inline style only for Decantr CSS-variable writes and truly dynamic geometry."
       })
     );
   }
@@ -11070,8 +11162,18 @@ function critiqueSource({
     reviewPack
   };
 }
+function resolveProjectFilePath(projectRoot, filePath) {
+  const root = existsSync2(projectRoot) ? realpathSync.native(projectRoot) : resolve(projectRoot);
+  const candidatePath = isAbsolute(filePath) ? resolve(filePath) : resolve(root, filePath);
+  const resolvedPath = existsSync2(candidatePath) ? realpathSync.native(candidatePath) : candidatePath;
+  const relativePath = relative(root, resolvedPath);
+  if (relativePath.startsWith("..") || isAbsolute(relativePath)) {
+    throw new Error(`Path escapes the project root: ${filePath}`);
+  }
+  return resolvedPath;
+}
 async function critiqueFile(filePath, projectRoot) {
-  const resolvedPath = isAbsolute(filePath) ? filePath : resolve(projectRoot, filePath);
+  const resolvedPath = resolveProjectFilePath(projectRoot, filePath);
   const code = await readFile(resolvedPath, "utf-8");
   const treatmentsCss = readTextIfExists(join2(projectRoot, "src", "styles", "treatments.css"));
   const reviewPack = loadReviewPack(projectRoot);